2017-09-04 Update: Openfire is now at version 4.1.5, but I think that most, if not all, of this guide is still relevant. Obviously, I cannot guarantee that until I actually do a fresh 4.1.5 (or higher) install on a brand new server (who knows when that will be). In the meantime, my confidence that this guide remains mostly relevant comes from the fact that I recently performed an upgrade of my server to Openfire 4.1.5 (from 3.10.2), to PostgreSQL 9.5 (from 9.3), and to Ubuntu 16.04.3 LTS (from 14.04.1 LTS) without any problem whatsoever. I have posted the upgrade guide here: Guide / Tutorial / Writeup / Walkthrough / How to: Upgrade Openfire 3.10.2 to 4.1.5, upgrade PostgreSQL 9.3 to 9.5, Upgrade Ubuntu 14.04.1 LTS to 16.04.3 LTS
I will not be maintaining or updating this document from this point onward. Any further updates (if necessary) will be posted as new documents, and those will be linked from the “upgrade” document that I linked above (forming a chain of links in chronological order). I will not be posting a new document for every upgrade - only when the upgrade process changes or introduces some new wrinkle. As the upgrade process is fairly straightforward and hassle-free, I don’t anticipate that I will need to update the “upgrade” guide for 4.1.6, etc. If someday I do a fresh install of Openfire to a new server, then I will repost the “install” guide below as a new document with an updated title (updated version numbers) and any relevant changes to the process.
Original “install” guide follows:
==============================================================================
In case this might help anyone else out, I wrote up a little step-by-step guide for this process in case I ever have to do it again. Let me know if you come across any errors or omissions and I will try to keep this updated:
Overall Reference: https://www.igniterealtime.org/builds/openfire/docs/latest/documentation/index.h tml
**Objectives **
- Get Openfire running
- Store to a PostgreSQL database
- Retrieve users from Active Directory (Tested with Windows Server 2012 Active Directory and Zentyal PDC running samba4)
- Use AD (LDAP) Users, but Local Groups
- Filtering only real Openfire users
- Secure server with SSL certificate
Notes
For purposes of this document, $ should mean Ubuntu shell, while =# indicates PostgreSQL shell.
I use vi as my editor of choice, but feel free to replace all references to vi with vim, nano, gedit, or whatever you like.
As of the latest edit, this document applies to the following software versions:
Ubuntu 14.04.1 LTS
Openfire 3.9.3 and 3.10.2
PostgreSQL 9.3
Oracle Sun Java 7 and 8
Steps:
1. Install Ubuntu
i. Setup primary user: UbuntuMainUser
Reference: http://www.simpleprecision.com/how-to-set-a-static-ip-to-ubuntu-14-04-server/
ii. Set network config
$ sudo vi /etc/network/interfaces
Reference: https://igniterealtime.jiveon.com/thread/52470
2. Download Openfire .deb
$ wget --no-certificate-check https://download.igniterealtime.org/openfire/openfire_3.10.2_all.deb
Reference: https://help.ubuntu.com/community/Java, http://www.duinsoft.nl/packages.php
3. Install latest version of Oracle Sun Java
i. $ sudo vi /etc/apt/sources.list
Add line: deb [http://www.duinsoft.nl/pkg](http://www.duinsoft.nl/pkg) debs all
ii. Import gpg key
$ sudo apt-key adv --keyserver keys.gnupg.net --recv-keys 5CB26B26
iii. Install Java
$ sudo apt-get update
$ sudo apt-get install update-sun-jre
Reference: https://help.ubuntu.com/community/PostgreSQL, https://www.igniterealtime.org/builds/openfire/docs/latest/documentation/databas e.html
4. Install latest version of PostgreSQL
$ sudo apt-get install postgresql postgresql-contrib
**5. Setup PostgreSQL database **
i. Set postgres user password
$ sudo -u postgres psql postgres
=# \password postgres
Ctrl + D
ii. Create Database for Openfire
$ sudo -u postgres createdb -E UNICODE openfire_db
iii. Create User and User Password for Openfire Database access
$ sudo -u postgres createuser -D -A -P db_admin
Reference: [http://www.postgresql.org/docs/9.3/static/sql-grant.html](http://www.postgresql.org/docs/9.3/static/sql-grant.html)
iv. Give User Access to Openfire Database
$ sudo -u postgres psql postgres
=# GRANT ALL PRIVILEGES ON openfire_db TO db_admin;
Ctrl + D
6. Install Openfire .deb
$ sudo dpkg -i openfire_3.10.2_all.deb
7. Import Openfire’s PostgreSQL schema
i. Add user UbuntuMainUser to PostgreSQL
$ sudo -u postgres createuser --superuser UbuntuMainUser
$ sudo -u postgres psql
=# \password UbuntuMainUser
Ctrl + D
ii. Grant all privileges to openfire_db to UbuntuMainUser
$ sudo -u postgres psql postgres
=# GRANT ALL PRIVILEGES ON DATABASE openfire_db TO "UbuntuMainUser";
Ctrl + D
iii. Copy schema file to UbuntuMainUser’s home directory
$ cp ../openfire/resources/database/openfire_postgresql.sql /home/UbuntuMainUser/
iv. Take ownership of schema file
$ sudo chown UbuntuMainUser:UbuntuMainuser openfire_postgresql.sql
v. Import schema file to Openfire Database
$ psql -d openfire_db -f /home/UbuntuMainUser/openfire_postgresql.sql
vi. Give ownership of Openfire Database back to Openfire Database User
$ sudo -u postgres psql postgres
=# ALTER DATABASE openfire_db OWNER to db_admin;
=# \c openfire_db;
=# REASSIGN OWNED BY "UbuntuMainUser" TO db_admin;
CTRL + D
8. Run Openfire webconfig at http://your.ubuntu.server.IP:9090
i. Language: English (or your choice)
ii. Server Info
*Domain*: Put here whatever you want to be after @ for your Openfire usernames. For example, if you want Jessica@openfire.company.com, put 'openfire.company.com' here.
Blowfish Encryption: Create your own long string of characters, letters, numbers, and symbols here
iii.Database
External Database
Type: PostgreSQL
Address: [http://localhost:5432/openfire_d ](http://localhost:5432/openfire_db) (Use database name from step 5.ii.)
Login: db_admin (User name from step 5.iii.)
Password: (from step 5.iii.)
Reference: https://forum.zentyal.org/index.php/topic,23324.0.html
iv.Profile (Directory Server / LDAP)
Double check your DN information on your samba4 server with the following command:
$ sudo ldbsearch -H /var/lib/samba/private/sam.ldb > ldbsearchresults.txt
$ vi ldbsearchresults.txt
Double check your DN information on your Windows Server using the dsquery CLI tool
Domain: local.company.com
Base DN: CN=Users,DC=local,DC=company,DC=com
Administrator DN: CN=AdministratorName,CN=Users,DC=local,DC=company,DC=com
Administrator Password: (from your PDC)
v. Admin User
If you have done everything right you should be able to add a user as an admin from your LDAP
Reference: https://igniterealtime.jiveon.com/thread/33144
9. Ignore Active Directory (LDAP) Groups
i. In Openfire webconfig: Server -> System Properties -> provider.group.className -> Edit
ii. Erase any value and leave blank
iii. Save
iv. Restart Openfire server
$ sudo service openfire restart
Reference: https://igniterealtime.jiveon.com/thread/30063, https://www.igniterealtime.org/builds/openfire/docs/latest/documentation/ldap-gu ide.html
10. Setup Filter
i. On your Primary Domain Controller (PDC), create a new group called “OpenfireUsers”
ii. Add all the users to whom you want to provide access to group “OpenfireUsers”
iii. In Openfire webconfig: Server -> System Properties -> ldap.searchFilter -> Edit
iv. Insert value: (&(objectClass=organizationalPerson)(memberOf=CN=OpenfireUsers,CN=Users,DC=local ,DC=Company,DC=com))
v. Save
vi. Restart Openfire server
$ sudo service openfire restart
Reference: https://help.ubuntu.com/community/IptablesHowTo, https://www.linode.com/docs/applications/messaging/instant-messaging-services-wi th-openfire-on-ubuntu-12-04-lts-precise-pangolin
11. Setup Ubuntu Firewall
i. Setup rules
$ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT (Ignore if you don’t want SSH access; Change if using different SSH port)
$ sudo iptables -A INPUT -p tcp --dport 3478 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 3479 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 5222 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 5223 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 5229 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 7070 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 7443 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 7777 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 9090 -j ACCEPT (Ignore if you don’t want to allow http webconfig access)
$ sudo iptables -A INPUT -p tcp --dport 9091 -j ACCEPT (Ignore if you don’t want to allow https webconfig access)
$ sudo iptables -I INPUT 1 -i lo -j ACCEPT
$ sudo iptables -A INPUT -j DROP
ii. Setup iptable rules to survive reboot
$ sudo iptables -L -v (Check IPTables)
$ sudo sh -c “iptables-save > /etc/iptables.rules”
$ sudo vi /etc/network/interfaces
Add line at end of eth0: pre-up iptables-restore < /etc/iptables.rules
$ sudo shutdown -r now
$ sudo iptables -L -v (Confirm New Rules survive reboot)
12. Install Security Certificate
** ** i. Upload your certificate files to your Openfire server.
** **In this case I used a wildcard certificate from Comodo.
Copy files to a working directory:
$ sudo mkdir /etc/ssl
$ sudo cp /home/UbuntuUser/certificate_files* /etc/ssl
$ cd /etc/ssl
ii. Import your certificates into Openfire
If you have a separate certificate.crt and private-key-decrypted.key and intermediates.ca-bundle files:
$ sudo openssl pkcs12 -export -in "/etc/ssl/certificate.crt" -inkey "/etc/ssl/private-key-decrypted.key” -certfile "/etc/ssl/intermediates.ca-bundle” -out "/etc/ssl/combined.p12" -name "myserver.domain.com.certificate.2015.06.30"
Export Password: changeit
$ sudo keytool -importkeystore -destkeystore keystore.mydomain.2015.06.30 -srckeystore combined.p12 -srcstoretype pkcs12 -alias "myserver.domain.com.certificate.2015.06.30"
Destination Keystore Password: changeit
Source Keystore Password: changeit
OR If you have a single certificate.pfx file
$ sudo keytool -importkeystore -destkeystore keystore.mydomain.2015.06.30 -srckeystore certificate.pfx -srcstoretype pkcs12 -alias "myserver.domain.com.certificate.2015.06.30"
Destination Keystore Password: changeit
Source Keystore Password: changeit
THEN
$ sudo /etc/init.d/openfire stop
$ sudo -i
$ cd /usr/share/openfire/resources/security
$ cp keystore keystore.bak
$ rm keystore
$ cp /etc/ssl/keystore.mydomain.2015.06.30 ./keystore
$ chmod 640 keystore
$ chown openfire:openfire keystore
$ ls -l (double-check)
$ su UbuntuUser
$ sudo /etc/init.d/openfire restart
iii. Confirm certificates are working:
Try connecting through a web browser to the web admin via https:// and port 9091
Try connecting to the server from a Jabber client using SSL encryption
** Test your OpenFire server at xmpp.net**
DO NOT WORRY if the web config under System Settings -> Security Certificates reports that One or more certificates are missing. This is a bug in the web config.
Note: Documentation states (Openfire: SSL Guide) that it is possible to change the default keystore and certificate passwords by using the xmpp.socket.ssl.keypass server property, but I was never able to get my certificates properly loaded using anything but the default passwords of changeit. Similarly, you should be able to change the default keystore location using xmpp.socket.ssl.keystore but I was again unsuccessful.
13. Setup DNS SRV Records
** ** Note: If you use a split-horizon DNS, you will need to add DNS SRV records to both your local private DNS server and your public DNS server. In my case I have a public DNS server with namecheap (but you might use DynDNS or whatever), and I have a local private DNS server running on Windows Server 2012 R2). Consult the Openfire webadmin page (https://your.ubuntu.server.IP:9091/dns-check.jsp) for more info on the exact DNS SRV records that your install is expecting.
Optional step: Allow external access to PostgreSQL database via PGAdminIII tool
i. Allow incoming connections
$ sudo vi /etc/postgresql/9.3/main/pg_hba.conf
Add line: host all all 192.168.1.0/24 md5
ii. Listen on all interfaces
$ sudo vi /etc/postgresql/9.3/main/postgresql.conf
Add line: listen_addresses=’*’
iii. Restart postgresql
$ sudo service openfire stop
$ sudo service postgresql restart
$ sudo service openfire start
iv. Download and instal pgAdminIII for your client and connect to the IP of the Openfire/PostgreSQL server
This document was generated from the following discussion: Guide / Tutorial / Writeup / Walkthrough: Setting up Openfire 3.9.3 with a PostgreSQL DB and Active Directory / LDAP integration